A web application accepts a file path parameter that is used to read files from the server. The validation logic rejects any input containing '..' or '/' to prevent path traversal. An attacker submits '%2e%2e%2f' and successfully reads a file outside the intended directory. What is the most effective countermeasure?

Canonicalize the input to its absolute path and verify it starts with the allowed base directory.

Use a regular expression that matches both '..' and '..\'

Add more encoded patterns to the denylist, such as '%2e' and '%2f'.

Reject any input that contains a percent sign.

A web application accepts a 'date' parameter that is used to filter records. The application validates that the date matches the format 'YYYY-MM-DD'. An attacker submits '2024-13-45' and the application accepts it, causing unexpected behavior. Which validation technique is missing?

A range check that verifies the month is 01–12 and the day is 01–31.

An allowlist of valid date strings.

A type check that ensures the input is a string.

A length check that ensures the date string is exactly 10 characters.

A web application accepts a 'country' parameter that is later used in a database query. The application currently uses a denylist that blocks common SQL injection strings such as ' OR 1=1 --. A security review recommends replacing the denylist with an allowlist. Which approach best implements an allowlist for this parameter?

Validate that the value matches a predefined list of ISO country codes before using it in the query.

Use a regular expression that allows letters and spaces only, and limit the length to 50 characters.

Reject any input that contains a single quote, a semicolon, or the word 'OR'.

Escape all single quotes and semicolons in the input before using it in the query.

A web application validates a 'file' parameter by checking that it does not contain '../' after URL decoding. An attacker submits 'file=....//' (double dot and double slash) and successfully reads a file outside the intended directory. What is the most effective way to prevent this bypass?

Reject any input that contains more than one consecutive dot.

Add '....//' to the denylist of blocked strings.

Canonicalize the path after decoding and then verify that the canonical path is within the intended directory.

Use a regular expression that matches any string containing '..'.

Which of the following is a common input validation bypass technique that uses a null byte?

Using a null byte to encrypt the input

Using a null byte to change the data type of the input

Using a null byte to increase the length of the input

Appending a null byte (e.g., %00) to a filename to truncate the string in some languages

GIAC Certified Web Application Defender

Domain 3Objective 1

Input Related Flaws and Input Validation GWEB Practice Questions (Page 2)

Part of the Input Handling and Injection Flaws domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

Questions 6–10

6application · hard
A web application accepts a file path parameter that is used to read files from the server. The validation logic rejects any input containing '..' or '/' to prevent path traversal. An attacker submits '%2e%2e%2f' and successfully reads a file outside the intended directory. What is the most effective countermeasure?
Select an answer first
7expert · hard
A web application accepts a 'date' parameter that is used to filter records. The application validates that the date matches the format 'YYYY-MM-DD'. An attacker submits '2024-13-45' and the application accepts it, causing unexpected behavior. Which validation technique is missing?
Select an answer first
8application · medium
A web application accepts a 'country' parameter that is later used in a database query. The application currently uses a denylist that blocks common SQL injection strings such as ' OR 1=1 --. A security review recommends replacing the denylist with an allowlist. Which approach best implements an allowlist for this parameter?
Select an answer first
9expert · hard
A web application validates a 'file' parameter by checking that it does not contain '../' after URL decoding. An attacker submits 'file=....//' (double dot and double slash) and successfully reads a file outside the intended directory. What is the most effective way to prevent this bypass?
Select an answer first
10foundation · easy
Which of the following is a common input validation bypass technique that uses a null byte?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Input Related Flaws and Input Validation GWEB Practice Questions (Page 2)

Questions 6–10

A web application accepts a 'date' parameter that is used to filter records. The application validates that the date matches the format 'YYYY-MM-DD'. An attacker submits '2024-13-45' and the application accepts it, causing unexpected behavior. Which validation technique is missing?

A web application validates a 'file' parameter by checking that it does not contain '../' after URL decoding. An attacker submits 'file=....//' (double dot and double slash) and successfully reads a file outside the intended directory. What is the most effective way to prevent this bypass?

Which of the following is a common input validation bypass technique that uses a null byte?

Keep studying — Input Handling and Injection Flaws